> ## Documentation Index
> Fetch the complete documentation index at: https://docs.domesystems.ai/llms.txt
> Use this file to discover all available pages before exploring further.
# dome audit
> Query, stream, get, export audit events, and list activity chains
| Command | |
| ----------------- | -------------------------------- |
| [Query](#query) | `dome audit query` |
| [Stream](#stream) | `dome audit stream` |
| [Get](#get) | `dome audit get [event-id]` |
| [Export](#export) | `dome audit export` |
| [Chains](#chains) | `dome audit chains` |
| [Chain](#chain) | `dome audit chain [activity-id]` |
All commands scope the read to the active workspace (from `dome config`), so the server checks the workspace-level `audit.view` permission. Switch workspaces with `dome workspace use ` before running the command. Tenant- or org-scoped API keys with no workspace selected fall back to the tenant-level `audit.view`.
***
## Query
`dome audit query`
Query audit events with optional filters.
| Flag | Type | Description |
| ------------------------- | --------- | ------------------------------------------------------------------------------------------------------------------------------------- |
| `--types` | string\[] | Filter by event types |
| `--classes` | string\[] | `governing`, `state_change`, `security`, `audit_access` |
| `--results` | string\[] | `attempted`, `succeeded`, `denied`, `failed`, `filtered`, `noop`, `permitted` |
| `--agent-id` | string | Filter by agent ID |
| `--agent-ids` | string\[] | Filter by agent IDs |
| `--primary-resource-id` | string | Filter by primary resource ID |
| `--primary-resource-kind` | string | Filter by primary resource kind |
| `--trace-id` | string | Filter by trace ID — events for one request |
| `--activity-id` | string | Filter by activity chain ID. Refer to [Activity chains](/reference/events#correlation) reference. |
| `--operation-id` | string | Filter by operation ID |
| `--parent-event-id` | string | Filter by parent event ID |
| `--actor-kind` | string | Filter by actor kind |
| `--actor-id` | string | Filter by actor ID |
| `--producer-service` | string | Filter by producer service |
| `--producer-gateway-id` | string | Filter by producer Gateway ID |
| `--request-surface` | string | Filter by request surface |
| `--caller-surface` | string | Filter by caller application surface |
| `--payload-filter` | string\[] | `event.type:field` or `event.type:field=value` (repeatable). Refer to [Payload filters](/reference/events#payload-filters) reference. |
| `--since` | string | Start time (RFC3339) |
| `--until` | string | End time (RFC3339) |
| `--limit` | int32 | Maximum results (default: 50) |
| `--page-token` | string | Cursor from a previous query |
| `--compact` | bool | Bounded investigation rows; use `audit get` for full payload |
## Stream
`dome audit stream`
Stream audit events in real-time via SSE. Accepts the same filters as [`query`](#query) except `--limit` and `--compact`.
| Flag | Type | Description |
| ------------------------- | --------- | ------------------------------------ |
| `--types` | string\[] | Filter by event types |
| `--classes` | string\[] | Filter by event classes |
| `--results` | string\[] | Filter by event results |
| `--agent-id` | string | Filter by agent ID |
| `--agent-ids` | string\[] | Filter by agent IDs |
| `--primary-resource-id` | string | Filter by primary resource ID |
| `--primary-resource-kind` | string | Filter by primary resource kind |
| `--trace-id` | string | Filter by trace ID |
| `--activity-id` | string | Follow one activity chain live |
| `--operation-id` | string | Filter by operation ID |
| `--parent-event-id` | string | Filter by parent event ID |
| `--actor-kind` | string | Filter by actor kind |
| `--actor-id` | string | Filter by actor ID |
| `--producer-service` | string | Filter by producer service |
| `--producer-gateway-id` | string | Filter by producer Gateway ID |
| `--request-surface` | string | Filter by request surface |
| `--caller-surface` | string | Filter by caller application surface |
| `--payload-filter` | string\[] | Payload filter (repeatable) |
| `--since` | string | Start time (RFC3339) |
| `--until` | string | End time (RFC3339) |
| `--page-token` | string | Cursor from a previous stream |
## Get
`dome audit get [event-id]`
Get a single audit event by ID.
Enum values — event class, result, actor kind, surface — render as short tokens (`governing`, `denied`, `gateway_mcp`) in both the table and `--format json` output, and the filter flags accept those same tokens. Refer to [Enum rendering](/reference/events#enum-rendering) reference.
## Export
`dome audit export`
Export audit events in JSON-lines, JSON, OCSF, or CEF format. Pick the format your downstream pipeline expects:
| Format | Output |
| ----------------- | ------------------------------------------------------------------ |
| `jsonl` (default) | One JSON object per line (NDJSON). |
| `json` | Single pretty-printed JSON array. |
| `ocsf` | OCSF v1.1.0 JSON array for Splunk, Sentinel, or Chronicle. |
| `cef` | Common Event Format lines for ArcSight, QRadar, or generic syslog. |
Accepts the same filters as [`query`](#query), plus:
| Flag | Type | Description |
| ---------- | ------ | -------------------------------------------------------- |
| `--limit` | int32 | Maximum results (default: 1000) |
| `--format` | string | `jsonl`, `json`, `csv`, `ocsf`, `cef` (default: `jsonl`) |
```bash theme={"system"}
# Export the last 24 hours as OCSF for a SIEM
dome audit export \
--since 2026-05-26T00:00:00Z \
--format ocsf > audit.ocsf.json
```
## Chains
`dome audit chains`
List activity chains in the active workspace. A chain is the set of audit events sharing one `activity_id` — a session, an LLM turn, a conversation thread, or a scripted run — computed at read time by grouping on `activity_id` within the workspace.
A chain is listed when **any** of its events matches the filter. Per-chain counts always reflect the full chain. Drill into one chain's events with [`dome audit chain `](#chain). Refer to [Activity chains](/reference/events#correlation) reference for the model and trust labels.
| Flag | Type | Description |
| -------------------- | --------- | -------------------------------------------------------------------------------------------------------------------------- |
| `--types` | string\[] | Chain contains an event of these types |
| `--classes` | string\[] | Chain contains an event of these classes (`governing`, `state_change`, `security`, `audit_access`) |
| `--results` | string\[] | Chain contains an event with these results (`attempted`, `succeeded`, `denied`, `failed`, `filtered`, `noop`, `permitted`) |
| `--agent-id` | string | Chain contains an event for this agent |
| `--agent-ids` | string\[] | Chain contains an event for these agents |
| `--actor-kind` | string | Chain contains an event with this actor kind |
| `--actor-id` | string | Chain contains an event with this actor ID |
| `--producer-service` | string | Chain contains an event from this producer service |
| `--request-surface` | string | Chain contains an event from this request surface |
| `--since` | string | Start time (RFC3339) |
| `--until` | string | End time (RFC3339) |
| `--limit` | int32 | Maximum chains (default: 50) |
| `--page-token` | string | Cursor from a previous chains query |
Per-event identity filters (`--trace-id`, `--operation-id`, `--parent-event-id`) and payload filters identify a single event, not a chain, and are not offered here.
```bash theme={"system"}
# Recent chains in the active workspace
dome audit chains --limit 20
# Chains that contain a denied governing event in the last day
dome audit chains \
--classes governing \
--results denied \
--since 2026-06-05T00:00:00Z
```
Each row reports the chain's `activity_id`, event count, last activity timestamp, outcome breakdown, trust label (`server-owned`, `caller-asserted`, or mixed — refer to [Activity trust](/reference/events#correlation) reference), and distinct event-type count.
## Chain
`dome audit chain [activity-id]`
Show one activity chain's events in order. A drill-in into `audit query` filtered by `activity_id`. Accepts the same per-event filters as `audit query` to narrow the chain's events further.
| Flag | Type | Description |
| ------------------ | --------- | ----------------------------------------------------------------------------- |
| `--types` | string\[] | Filter by event types |
| `--classes` | string\[] | Filter by event classes |
| `--results` | string\[] | Filter by event results |
| `--agent-id` | string | Filter by agent ID |
| `--actor-kind` | string | Filter by actor kind |
| `--actor-id` | string | Filter by actor ID |
| `--payload-filter` | string\[] | Payload filter as `event.type:field` or `event.type:field=value` (repeatable) |
| `--since` | string | Start time (RFC3339) |
| `--until` | string | End time (RFC3339) |
| `--limit` | int32 | Maximum events (default: 200) |
| `--page-token` | string | Cursor from a previous query |
```bash theme={"system"}
# Every event in one chain
dome audit chain case-12345
# Only the denied events in that chain
dome audit chain case-12345 --results denied
```
## Emit events into a chain
Set `--activity` (or `DOME_ACTIVITY_ID`) on the root command to assert a stable activity ID. Every Connect RPC the run makes carries `X-Dome-Activity-Id`, so the audit events all share one `activity_id` and form one chain.
```bash theme={"system"}
# One run, many commands, one chain.
export DOME_ACTIVITY_ID="case-12345"
dome agents register --name worker
dome rules deploy ./rules
dome audit query --limit 5
# Inspect the chain you just emitted.
dome audit chains --since 2026-06-05T00:00:00Z
dome audit chain case-12345
```
`--activity` overrides `DOME_ACTIVITY_ID`. The ID is opaque to Dome — pick whatever maps to your unit of work. The header is first-party only and is never forwarded to third-party LLM or MCP backends.
The `--activity` emit flag (root command) and the `--activity-id` filter flag (audit reads) are distinct: one stamps events, the other selects them.